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Information Commissioner’s Office 
Parliament and Government Affairs 

Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 SAF 

By email: politicalcampaigning@ICO. org.uk 


11 January 2019 
Dear Sir/Madam, 


CALL FOR VIEWS: CODE OF PRACTICE FOR THE USE OF PERSONAL INFORMATION IN 
POLITICAL CAMPAIGNS 


I wish to respond to the Information Commissioner’s call for evidence on behalf of the 
Conservative Party. 


Need to support democratic engagement 


The starting point for any potential new statutory guidance is that it should support and 
facilitate democratic engagement. As the Government’s democratic engagement strategy has 
noted: ‘A thriving democracy depends upon the participation of eligible electors. Their voices 
are the bedrock of a plural, representative system that reflects the will of the people. The 
foundations of our government, society and freedoms are made stronger when more people get 
involved’ (Cabinet Office, Democratic Engagement Plan, December 2017, p.28). 


When the Data Protection Act 2018 was passed by Parliament, both the Government and 
Parliament, with cross-party support, were clear that the legislation explicitly needed to protect 
democratic engagement and avoid any gold-plating of the GDPR which could undermine that 
principle. This is why the Act was amended to state that democratic engagement is a task in 
the public interest. 


Parliament also legislated to ensure that the definition of democratic engagement was a wide 
one. The Explanatory Notes to the Act explain ‘democratic engagement is intended to cover a 
wide range of political activities inside and outside election periods, including but not limited 
to: democratic representation, communicating with electors and interested parties, surveying 
and opinion gathering, campaigning activities, activities to increase voter turnout, supporting 
the work of elected representatives, prospective candidates and official candidates and 

fundraising to support any of these activities’. | 


As the Notes highlight, democratic engagement is an all year-round activity: it is not restricted | 
to election periods. This is important to bear in mind when considering the application of data 
protection principles to political campaigning. 


The Call for Evidence seems to suggest that the lawful basis of ‘democratic engagement’ | 


should be clarified or narrowed. Yet this would in direct contradiction of the legislation | 
intentionally framed widely and passed by Parliament, where Parliamentarians took a different 
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review to the evidence presented to the Bill Committee by the Information Commissioner.! We 
would observe that Recital 45 of GDPR simply states that processing for a public task should 
have a legal basis, and Member States have the discretion to determine this. 


Data protection law has already changed 


The second key point of note is that the Data Protection Act 2018 and GDPR have already 
significantly overhauled data protection laws. Legislation now provides for substantive fines, 
a new definition of consent, stronger rights to withdraw consent, revised data protection 
principles and enhanced requirements for data protection impact assessments and for 
notifications of breaches. 


Rightly, there has been public concern about the actions of Cambridge Analytica. We would 
note that such activity would breach many provisions of both the 1998 and the 2018 Data 
Protection Acts, and none of the provisions on democratic engagement in the Act would 
legitimise such dubious acts. Extra statutory regulation is not necessary because the law has 
already changed significantly and been comprehensively tightened. 


However, there will be unforeseen and unintended consequences from that legislation — such 
as in the form of gold-plating. 


For example, we have already seen how some MPs have wrongly assumed that they need to 
delete historic constituency casework? (whereas, if there is a business case for retention, it can 
be retained), and MSPs have faced excessive bureaucracy if they want to work with local 
schools to run a Christmas Card competition.’ 


We believe it would be sensible to wait for the new laws to bed in, before any statutory code 
is introduced. The purpose of any code should be to help clarify any ambiguities — yet, those 
ambiguities or myths need to be identified first. It is not the role of the Code to try to amend or 
change the law that Parliament has passed. 


Use of the electoral register 


The electoral register has a fundamental role in facilitating democratic engagement, and it is 
important that it can continue to be used and processed inside and outside election time. 
Political parties also need to retain many years of the marked register data, and it helps parties 
identify the likelihood to vote, allowing targeting of both frequent and infrequent voters, and 
thus help encourage more electors to turn out to vote as a result. Such data may also be 
processed in conjunction with other datasets to help political parties identify who to contact 
(given there are tight spending controls in elections and a ban on television advertising, which 
therefore inhibit large blanket advertising). 

One should also draw a distinction between the activities of elected representatives, candidates 
standing for office and registered political parties (‘authorised persons’ in electoral law)* — 
whose spending and donations are tightly regulated and transparent — and actions of other third 
parties which are not. Third parties do not have the same access to the full (non-edited) electoral 


1 ICO, Data Protection Bill, House of Commons Public Bill Committee — Information Commissioner’s further 
written evidence, 19 March 2018. 

? BBC News Online, ‘GDPR has MPs in a bind’, 15 May 2018. 

3 The Times, ‘Grinch of GDPR steals children’s Christmas card contest’, 18 November 2018. 

4 As amended by the Representation of the People (England and Wales)(Amendment) Regulations 2002. 


register. The ongoing use of the electoral register data by authorised persons under data 
protection law should reflect the long-standing legal principles and the legal basis for its use in 
electoral law. Equally, we would note that the legal basis for its use by non-authorised persons 
would accordingly be weaker. 


It should also be noted that political parties must register under the Political Parties Elections 
and Referendums Act 2000, and candidates for elected office must also meet requirements 
under the Representation of the People Act 1983 (including requirements to obtain signatures 
to nominate, pay deposits in some elections, publish imprints on election materials, abide by 
spending controls and other regulatory prohibitions, and publish returns on spending and 
donations). In this context, such activity by parties and candidates are already tightly regulated, 
and therefore access to and use of the full register is necessarily regulated as a consequence. 
Those pieces of legislation also provide a statutory basis for the task in the public interest. It is 
important that data protection law and electoral law are not inconsistent. 

Electoral law allows for electoral register data to be used for ‘electoral purposes’ by authorised 
persons, and Ministers have previously told Parliament that this should be interpreted in a broad 
and wide manner. Notwithstanding, the Government has signalled that it intends to amend 
electoral law to ensure the democratic engagement provision in the Data Protection Act 2018 
is also mirrored in electoral law. This will help ensure there is an even clearer legal basis for 
democratic engagement’s task in the public interest. Given the Government’s intention to 
legislate, it would be unwise for any statutory code to pre-empt or contradict that secondary 
legislation. 


We would observe that there is no significant adverse impact on an individual on whether or 
not they receive a campaign message as a consequence of data analytics and targeting. There 
is no affect on the provision of, or access to, goods and services. Political marketing is not a 
commercial activity, but essentially a voluntary sector activity by non-commercial bodies. 


Finally, it is important that any Code has the broad support of Members of Parliament and 
facilitates their ongoing Parliamentary, constituency and campaigning work, given Members 


of Parliament will be required to vote on and approve any Code. 


I hope this is helpful to the Commissioner’s call for views. 


5 Ministers stated: ‘It is right not to pin down “electoral purposes” too narrowly. We do not want to omit anything 
that counts as an important part of what political parties and those seeking to represent the people in a democracy 
should be able to do to communicate with voters. Voters themselves should have their human right to participate 
in free and fair elections recognised. In a democracy, it is crucial to sustain those principles’ (Yvette Cooper, 
House of Commons, Delegated Legislation Standing Committee, 11 July 2002, Column 21). These principles were 
also referenced in Electoral Commission’s Circular EC 36/2002. 


